Machine Learning with Electronic Health Records is vulnerable to Backdoor Trigger Attacks

Abstract

Electronic Health Records (EHRs) provide a wealth of information for machine learning algorithms to predict the patient outcome from the data including diagnostic information, vital signals, lab tests, drug administration, and demographic information. Machine learning models can be built, for example, to evaluate patients based on their predicted mortality or morbidity and to predict required resources for efficient resource management in hospitals. In this paper, we demonstrate that an attacker can manipulate the machine learning predictions with EHRs easily and selectively at test time by backdoor attacks with the poisoned training data. Furthermore, the poison we create has statistically similar features to the original data making it hard to detect, and can also attack multiple machine learning models without any knowledge of the models. With less than 5% of the raw EHR data poisoned, we achieve average attack success rates of 97% on mortality prediction tasks with MIMIC-III database against Logistic Regression, Multilayer Perceptron, and Long Short-term Memory models simultaneously.

Exploiting Missing Value Patterns for a Backdoor Attack on Machine Learning Models of Electronic Health Records: Development and Validation Study

“…In the “Attack Efficacy” section of this paper, we describe 2 experiments that investigated “random poisoning” and “target poisoning.” To assess the stealthiness of the attack, we experimented with the visual similarity between the trigger data and the clean data (described in the “Stealthiness” section) and the impact of an attack on general classification performance (“Impact on Classification Performance” section). We also compare performance with an existing technique [ 19 ] in the “Comparative Performance” section.…”

“…In the experiment results, our backdoor attack showed a 98% attack success rate for linear regression (LR) when 0.4% of the training data set was poisoned with trigger data. Considering that the previous approach [ 19 ] required 3% data poisoning to achieve the same success rate, our attack shows significant performance improvements. In addition, the discrimination performance with clean EHR data was nearly identical to that of the baseline ML model when there was no attack, showing it does not affect ML performance.…”

“…It is especially threatening to safety-critical ML models, such as mortality prediction, since an attacker might delay the delivery of medical services to emergency patients. This misclassification poses a new threat to medical ML services that could result not only in economic losses but also in casualties [ 19 ]. Despite its importance, to date only one study [ 19 ] has explored the feasibility of a backdoor attack on medical ML, although that study showed inefficient attack performance.…”

“…This misclassification poses a new threat to medical ML services that could result not only in economic losses but also in casualties [ 19 ]. Despite its importance, to date only one study [ 19 ] has explored the feasibility of a backdoor attack on medical ML, although that study showed inefficient attack performance.…”

TRAPDOOR: Repurposing backdoors to detect dataset bias in machine learning-based genomic analysis

“…Since then, there have been several attacks and defenses in neural networks with attacks focusing on stealth and undetectability and defenses focusing on generalization of detection across datasets and applications [14,26]. The backdoor attack literature primarily focuses on DNNs, specifically because of the black-box nature of DNNs which deters the development of a generic defense, with very few focusing on smaller models [20,45]. The triggers are designed from the perspective of the input, rather than the model, so that they remain hidden (inconspicuous) from the user.…”